Continuous exposure management company XM Cyber Inc. today announced an expansion of its platform with new capabilities aimed at helping enterprises enforce least-privilege access across Active Directory, Microsoft Entra and multicloud environments.

The company is targeting one of the most exploited weaknesses in modern enterprise security: excessive permissions. Overprovisioned identities give attackers ready-made paths for lateral movement once a single account is compromised, a problem that has grown more acute as artificial intelligence speeds up credential-based attacks.

The new release adds two capabilities to XM Cyber’s existing identity coverage.

The first, Active Directory Excessive Permissions, evaluates how often AD entities actually use the privileges assigned to them, giving identity teams evidence to justify revoking access that sits idle. The second is a Cloud Infrastructure Entitlement Management feature that profiles entitlement usage patterns across large multi-cloud estates so DevSecOps and cloud security teams can clean up overly permissive roles.

The idea is that raw permissions data is not enough on its own. By tying usage telemetry to validated attack paths the platform already maps, the company says, teams can distinguish between permissions that look risky on paper and those that actually sit on a route an attacker could traverse to a critical asset.

“Least privilege access is a well-established principle for maintaining an effective security posture, but many organizations still struggle to achieve it due to the complexity of managing identities and access at enterprise scale,” said co-founder and Chief Technology Officer Boaz Gorodissky. “We’re adding granular visibility into access permissions and their actual usage so teams can quickly see whether elevated permissions across Active Directory, Entra and cloud platforms are actually being used. If they aren’t, that’s a clear opportunity to remove permissions to reduce the attack surface and improve risk posture without disrupting operations.”

The release builds on XM Cyber’s existing platform coverage, which already surfaces roles with excessive permissions, cached and leaked credentials, exposed local and domain accounts and the security posture of third-party identity tools. Embedding permission usage data into that view is intended to feed faster remediation handoffs between information technology, DevOps and security teams.

Gartner Inc. predicts that by 2028, 70% of chief information security officers will rely on identity visibility and intelligence tools to shrink the identity and access management attack surface and cut the risk of credential compromise.

Image: XM Cyber